CVE-2026-114583

published 2026-10-22

CVE-2026-114583: tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members…

Priority P4 24 medium 6.9 CVSS 4.0

AV L AC L AT N PR N UI N VC N VI H VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.

This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
python_software_foundation	cpython	< 3.16.0	3.16.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.